firewall: slow load on logs web page for empty interfaces

[fichtner]

via: https://forum.opnsense.org/index.php?topic=2010.0

[fraenki]

Excuse me if this is not related, but searching the firewall log is incredibly slow for me. I've collected some data:

Firewall->Log Files->Normal View
~3 seconds

Filter: Interface (i.e. WAN or LAN)
between 5 and 40 seconds (depending on the interface)

Filter: Destination IP Address (i.e. 8.8.8.8)
~110 seconds

Filter: Interface AND Destination IP Address (i.e. WAN and 8.8.8.8)
~120 seconds

Filter: Destination Port (i.e. 500)
~100 seconds

During the search my machine is mostly idle with noticable system load:

last pid: 51214;  load averages:  0.46,  0.25,  0.22                  up 26+23:25:24  15:28:53
231 processes: 6 running, 190 sleeping, 35 waiting
CPU:  8.9% user,  0.0% nice, 15.9% system,  1.8% interrupt, 73.4% idle
Mem: 36M Active, 280M Inact, 412M Wired, 856K Cache, 612M Buf, 7143M Free
Swap: 

  PID USERNAME   PRI NICE   SIZE    RES STATE   C   TIME    WCPU COMMAND
   11 root       155 ki31     0K    64K CPU3    3 633.2H 100.00% idle{idle: cpu3}
   11 root       155 ki31     0K    64K CPU0    0 624.4H 100.00% idle{idle: cpu0}
   11 root       155 ki31     0K    64K RUN     1 632.0H  98.29% idle{idle: cpu1}
   11 root       155 ki31     0K    64K CPU2    2 630.8H  96.19% idle{idle: cpu2}
59241 root        73    0   190M 93788K CPU3    3   1:46   4.88% php-cgi

# clog /var/log/filter.log | wc -l
   37946

And gstat does show only some minor disk access. So I'm wondering why searching the logs is sooo slow.

[AdSchellevis]

firewall log parsing is really messy here.... eventually this should be trashed in favour of something new and remove all the call loops and obscure code around it, but not today.

The slowdown in parsing for this case is very likely caused by convert_real_interface_to_friendly_descr() being called on every line.... moved it out of the loop.
At my end this is about 10 times faster on a search without results (worst case scenario).